Missing authorization check in BPC Web & Web Administration, SAP security note 1846945 RedRays Team November 11, 2013
The subfolder parameter does not allow “..” anymore, SAP security note 1264767 RedRays Team October 8, 2009